High severity7.5NVD Advisory· Published Jul 1, 2026· Updated Jul 24, 2026
CVE-2026-54399
CVE-2026-54399
Description
Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.httpcomponents.core5:httpcore5Maven | < 5.4.3 | 5.4.3 |
org.apache.httpcomponents.core5:httpcore5Maven | >= 5.5-alpha1, < 5.5-beta2 | 5.5-beta2 |
Affected products
119- osv-coords114 versionspkg:apk/chainguard/kayenta-fips-2026.1pkg:apk/chainguard/elasticsearch-9.2-iamguardedpkg:apk/chainguard/elasticsearch-9.3-iamguardedpkg:apk/chainguard/geoserver-3.0pkg:apk/wolfi/opensearch-3-notificationspkg:apk/chainguard/airbyte-serverpkg:apk/wolfi/kserve-modelmeshpkg:apk/chainguard/logstash-fips-9.5-iamguarded-compatpkg:apk/chainguard/elasticsearch-fips-9.3pkg:apk/chainguard/hadoop-fips-3.5pkg:apk/chainguard/logstash-9.4-iamguarded-compatpkg:apk/chainguard/opensearch-3-sqlpkg:apk/chainguard/logstash-fips-9.4pkg:apk/chainguard/opensearch-3-alertingpkg:apk/wolfi/nrjmxpkg:apk/chainguard/airbyte-platform-bootloaderpkg:apk/chainguard/airbyte-platform-fips-workload-api-serverpkg:apk/chainguard/logstash-9.5-iamguarded-compatpkg:apk/chainguard/nacospkg:apk/chainguard/pinotpkg:apk/chainguard/sonarqubepkg:apk/chainguard/airbyte-platform-fips-workerspkg:apk/chainguard/elasticsearch-9.4-iamguardedpkg:apk/chainguard/logstash-fips-9.5pkg:apk/wolfi/opensearch-3-alertingpkg:apk/wolfi/opensearch-3-anomaly-detectionpkg:apk/wolfi/opensearch-3-sqlpkg:apk/chainguard/jmeterpkg:apk/chainguard/airbyte-platform-fips-bootloaderpkg:apk/chainguard/airbyte-platform-workload-launcherpkg:apk/chainguard/dependency-track-apiserver-4pkg:apk/chainguard/elasticsearch-9.5-iamguarded-fipspkg:apk/chainguard/opensearch-fips-3-anomaly-detectionpkg:apk/chainguard/kayenta-2026.0pkg:apk/chainguard/opensearch-fips-3-sqlpkg:apk/chainguard/airbyte-platform-fips-serverpkg:apk/chainguard/opensearch-fips-3-alertingpkg:apk/chainguard/opensearch-fips-3-cross-cluster-replicationpkg:apk/chainguard/akhqpkg:apk/chainguard/elasticsearch-9.2pkg:apk/chainguard/elasticsearch-9.3pkg:apk/chainguard/elasticsearch-9.3-iamguarded-fipspkg:apk/chainguard/flocipkg:apk/chainguard/kayenta-fips-2026.0pkg:apk/chainguard/kserve-modelmeshpkg:apk/chainguard/logstash-9.4pkg:apk/chainguard/logstash-9.5pkg:apk/chainguard/logstash-fips-9.4-iamguarded-compatpkg:apk/chainguard/nacos-dockerpkg:apk/chainguard/nuxeo-2023pkg:apk/chainguard/opensearch-3-anomaly-detectionpkg:apk/chainguard/opensearch-3-cross-cluster-replicationpkg:apk/chainguard/opensearch-3-ml-commonspkg:apk/chainguard/opensearch-fips-3-k-nnpkg:apk/chainguard/opensearch-fips-3-securitypkg:apk/chainguard/reposilitepkg:apk/chainguard/thingsboard-tb-mqtt-transportpkg:apk/chainguard/thingsboard-tb-nodepkg:apk/chainguard/traccarpkg:apk/chainguard/traccar-fipspkg:apk/chainguard/wavefront-proxypkg:apk/chainguard/wso2ispkg:apk/wolfi/apicurio-registrypkg:apk/wolfi/cassandra-reaperpkg:apk/wolfi/druidpkg:apk/wolfi/logstash-9.4pkg:apk/wolfi/logstash-9.4-iamguarded-compatpkg:apk/wolfi/opensearch-3pkg:apk/wolfi/opensearch-3-cross-cluster-replicationpkg:apk/wolfi/thingsboard-tb-nodepkg:apk/chainguard/floci-azpkg:apk/chainguard/elasticsearch-9.2-iamguarded-fipspkg:apk/chainguard/opensearch-fips-3-ml-commonspkg:apk/chainguard/opensearch-3-notificationspkg:apk/wolfi/opensearch-3-securitypkg:apk/chainguard/airbyte-platform-fips-workload-launcherpkg:apk/chainguard/apache-hop-fipspkg:apk/chainguard/apicurio-registrypkg:apk/chainguard/elasticsearch-9.4-iamguarded-fipspkg:apk/chainguard/opensearch-fips-3-index-managementpkg:apk/chainguard/opensearch-fips-3-notificationspkg:apk/wolfi/opensearch-3-ml-commonspkg:apk/wolfi/wavefront-proxypkg:apk/chainguard/apicurio-registry-fipspkg:apk/chainguard/camunda-zeebe-8.6pkg:apk/chainguard/cassandra-reaperpkg:apk/chainguard/conductorpkg:apk/chainguard/conductor-fipspkg:apk/chainguard/jbangpkg:apk/chainguard/kayenta-2026.1pkg:apk/wolfi/sonarqubepkg:apk/chainguard/apache-hoppkg:apk/wolfi/akhqpkg:apk/chainguard/airbyte-platform-workload-api-serverpkg:apk/chainguard/apache-nifi-2.11pkg:apk/chainguard/opensearch-3-securitypkg:apk/chainguard/airbyte-platform-cronpkg:apk/chainguard/druidpkg:apk/chainguard/opensearch-fips-3pkg:apk/chainguard/elasticsearch-fips-9.2pkg:apk/chainguard/elasticsearch-fips-9.4pkg:apk/chainguard/airbyte-platform-workerspkg:apk/chainguard/airbyte-server-fipspkg:apk/chainguard/elasticsearch-9.4pkg:apk/chainguard/nrjmxpkg:apk/wolfi/opensearch-3-k-nnpkg:apk/wolfi/thingsboard-tb-mqtt-transportpkg:apk/chainguard/opensearch-3-k-nnpkg:apk/chainguard/airbyte-platform-serverpkg:apk/chainguard/opensearch-3pkg:apk/chainguard/airbyte-platform-fips-cronpkg:apk/chainguard/opensearch-2-ml-commonspkg:apk/chainguard/pinot-fipspkg:apk/chainguard/wazuh-indexer-plugin-ml-commons
< 2026.1.2-r3+ 113 more
- (no CPE)range: < 2026.1.2-r3
- (no CPE)range: < 9.2.8-r10
- (no CPE)range: < 9.3.8-r2
- (no CPE)range: < 3.0.0-r7
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 2.0.0-r10
- (no CPE)range: < 0.12.0-r39
- (no CPE)range: < 9.5.2-r4
- (no CPE)range: < 9.3.7-r6
- (no CPE)range: < 3.5.0-r3
- (no CPE)range: < 9.4.5-r1
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 9.4.5-r3
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 2.13.0-r1
- (no CPE)range: < 2.0.0-r1
- (no CPE)range: < 2.0.0-r1
- (no CPE)range: < 9.5.2-r3
- (no CPE)range: < 3.2.3-r8
- (no CPE)range: < 1.5.1-r13
- (no CPE)range: < 26.8.0.126808-r1
- (no CPE)range: < 2.0.0-r1
- (no CPE)range: < 9.4.4-r4
- (no CPE)range: < 9.5.2-r4
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 5.6.3-r3
- (no CPE)range: < 2.0.0-r1
- (no CPE)range: < 2.0.0-r1
- (no CPE)range: < 4.14.3-r3
- (no CPE)range: < 9.5.1-r0
- (no CPE)range: < 3.8.0-r1
- (no CPE)range: < 2026.0.7-r1
- (no CPE)range: < 3.8.0-r1
- (no CPE)range: < 2.0.0-r1
- (no CPE)range: < 3.8.0-r1
- (no CPE)range: < 3.8.0-r1
- (no CPE)range: < 0.28.0-r3
- (no CPE)range: < 9.2.8-r10
- (no CPE)range: < 9.3.8-r2
- (no CPE)range: < 9.3.7-r6
- (no CPE)range: < 1.6.0-r1
- (no CPE)range: < 2026.0.5-r1
- (no CPE)range: < 0.12.0-r39
- (no CPE)range: < 9.4.5-r1
- (no CPE)range: < 9.5.2-r3
- (no CPE)range: < 9.4.5-r3
- (no CPE)range: < 3.2.3-r5
- (no CPE)range: < 2023.45-r6
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.8.0-r1
- (no CPE)range: < 3.8.0-r1
- (no CPE)range: < 3.6.2-r0
- (no CPE)range: < 4.3.1.3-r17
- (no CPE)range: < 4.3.1.3-r17
- (no CPE)range: < 6.14.5-r3
- (no CPE)range: < 6.14.5-r5
- (no CPE)range: < 13.9-r28
- (no CPE)range: < 7.3.0-r3
- (no CPE)range: < 3.3.1-r4
- (no CPE)range: < 5.0.0-r6
- (no CPE)range: < 37.0.0-r49
- (no CPE)range: < 9.4.5-r1
- (no CPE)range: < 9.4.5-r1
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 4.3.1.3-r17
- (no CPE)range: < 0.10.0-r1
- (no CPE)range: < 9.2.8-r9
- (no CPE)range: < 3.8.0-r1
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 2.0.0-r1
- (no CPE)range: < 2.19.0-r0
- (no CPE)range: < 3.3.1-r4
- (no CPE)range: < 9.4.5-r0
- (no CPE)range: < 3.8.0-r1
- (no CPE)range: < 3.8.0-r1
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 13.9-r28
- (no CPE)range: < 3.3.1-r4
- (no CPE)range: < 8.6.39-r8
- (no CPE)range: < 5.0.0-r6
- (no CPE)range: < 3.32.1-r1
- (no CPE)range: < 3.32.1-r4
- (no CPE)range: < 0.141.0-r2
- (no CPE)range: < 2026.1.2-r3
- (no CPE)range: < 26.8.0.126808-r1
- (no CPE)range: < 2.19.0-r0
- (no CPE)range: < 0.28.0-r3
- (no CPE)range: < 2.0.0-r1
- (no CPE)range: < 2.11.0-r2
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 2.0.0-r1
- (no CPE)range: < 37.0.0-r49
- (no CPE)range: < 3.8.0-r1
- (no CPE)range: < 9.2.8-r9
- (no CPE)range: < 9.4.5-r0
- (no CPE)range: < 2.0.0-r1
- (no CPE)range: < 2.0.0-r12
- (no CPE)range: < 9.4.4-r4
- (no CPE)range: < 2.13.0-r1
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 4.3.1.3-r17
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 2.0.0-r1
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 2.0.0-r1
- (no CPE)range: < 2.19.6-r7
- (no CPE)range: < 1.5.1-r9
- (no CPE)range: < 4.14.7-r4
<5.5-beta1+ 4 more
- (no CPE)range: <5.5-beta1
- cpe:2.3:a:apache:httpcomponents_core:*:*:*:*:*:*:*:*range: >=5.0,<=5.4.2
- cpe:2.3:a:apache:httpcomponents_core:5.5:alpha1:*:*:*:*:*:*
- cpe:2.3:a:apache:httpcomponents_core:5.5:beta1:*:*:*:*:*:*
- (no CPE)range: <=5.4.2, <=5.5-beta1
Patches
Vulnerability mechanics
References
6- www.openwall.com/lists/oss-security/2026/07/01/4nvdMailing ListThird Party AdvisoryWEB
- github.com/advisories/GHSA-hf6x-8p5f-cgmfghsaADVISORY
- lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpynvdMailing ListVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-54399ghsaADVISORY
- github.com/apache/httpcomponents-core/commit/d96a00fec9b2e19f8005e35681df5f6cd6e21a9eghsaWEB
- github.com/apache/httpcomponents-core/commit/fdc53a32fe0fccf098cc67e71cd125e447c759edghsaWEB
News mentions
1- Apache Software Foundation: 21 Vulnerabilities Across Multiple Products Disclosed in Early July 2026Vypr Intelligence · Jul 3, 2026